73103084cf3061baa5ff5e98384e126b890b0ec18a50407391aba961e5ec96aa

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_bdd7ab82bdb09122cb9bd0b5a6c4ecc1_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260703-v3bc9sds4t
SHA256 73103084cf3061baa5ff5e98384e126b890b0ec18a50407391aba961e5ec96aa
MD5 bdd7ab82bdb09122cb9bd0b5a6c4ecc1
SHA1 f47d01382f95915169d0826c5e3048cc53a30e9b
SHA512 af71f51836adde6e78b1a226e9ee35d55389c96945e62b0e5d6b546f98507bf249e3fc46707e3548d79e4a3efe91c2eced3778bdf36597c3b46b9137a51d95fb
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtv5ZPrEt7kyeHzJvz8dtfYh/hG+L6rSIAoH48:Ci4g+yU+0pAiv+tzEy9TJv4ToF6+32xn
TLSH
T17294F1213582C033E59615358BF6CB69557E79710B2264CB2BC02BAE2FB43E2E37535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5544	4CDE.tmp

Executes dropped EXE 1 IoCs

pid	Process
5544	4CDE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_bdd7ab82bdb09122cb9bd0b5a6c4ecc1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4CDE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 5544	5852	2026-07-03_bdd7ab82bdb09122cb9bd0b5a6c4ecc1_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_bdd7ab82bdb09122cb9bd0b5a6c4ecc1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_bdd7ab82bdb09122cb9bd0b5a6c4ecc1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Temp\4CDE.tmp
  "C:\Users\Admin\AppData\Local\Temp\4CDE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-03_bdd7ab82bdb09122cb9bd0b5a6c4ecc1_elex_mafia_stealc_tofsee.exe 2EA058FBA8816FAC8C8E18E36FA3BE839DEBD9A49A64FD9C53D963772FAD7F581A91BCD101AB05C861BB545D78438A44B09851B1F2F68E1AE277FDAB5F8AE566
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4CDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\4CDE.tmp
Size 433KB
SHA256 453d3094e8796302a481df80fc24ba939a8e806c4ad6be765874a78f98421257
MD5 f957aba761ae803412a5b5c9d35ec28a
SHA1 ca68058f5e7705603cfb50b622642beeab7e1c87
SHA512 a798b173c369b16ba486f76aa28e5a9b29400172c0092996ff568c534144ad7a142a595542af67d2af8be7c0b014bf485919d00672ac9b7eedea497d5f6c9673
SSDEEP 12288:Ci4g+yU+0pAiv+c+oCOsaXmDM5SNx5Orred1uNn:Ci4gXn0pD+vXyXP5Sjo+w
TLSH
T1DE94E0207582C033E6A719354BE5DBAA35BE75A50722A8CB3BD01BBD6F603D2D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download